CVE-2025-14967: itsourcecode Student Management System candidates_report.php sql injection
A vulnerability was identified in itsourcecode Student Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /candidatesreport.php. The manipulation of the argument schoolyear leads to sql injection. The attack can be initiated remotely. The exploit is publicly available and might be used.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-14967?
CVE-2025-14967 is classified as a high severity vulnerability due to its potential for remote SQL injection.
How do I fix CVE-2025-14967?
To fix CVE-2025-14967, ensure proper input validation and use prepared statements to prevent SQL injection in the /candidates_report.php file.
What types of attacks can be executed using CVE-2025-14967?
CVE-2025-14967 can be exploited to perform SQL injection attacks, potentially exposing sensitive database information.
Which software is affected by CVE-2025-14967?
CVE-2025-14967 affects the itsourcecode Student Management System version 1.0.
Is remote exploitation possible with CVE-2025-14967?
Yes, remote exploitation of CVE-2025-14967 is possible, allowing attackers to manipulate the SQL query via the school_year argument.